Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/04/2026, 03:45
General
- Target 2026-04-19_a251ce7bfd0cbc459408b1d3caa31d42_elex_wannacry.exe
- Size 60KB
- Sample260419-ebct1shs8v
- SHA256 e0e1c14edf56cc2454a822d23fb7576677d91656c87c3fb5f49e91dc12e6381b
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 9 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 9 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 9 IoCs
- Drops file in Windows directory 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_a251ce7bfd0cbc459408b1d3caa31d42_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_a251ce7bfd0cbc459408b1d3caa31d42_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D8E17C86-F2E6-42bc-93EC-5CD710F670BD}.exeC:\Windows\{D8E17C86-F2E6-42bc-93EC-5CD710F670BD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76770354-F8BB-43b8-A310-F44E2B453D17}.exeC:\Windows\{76770354-F8BB-43b8-A310-F44E2B453D17}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D9CFF881-3BAE-4cda-AEFC-EC9BF65D959C}.exeC:\Windows\{D9CFF881-3BAE-4cda-AEFC-EC9BF65D959C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F18D1B50-3A0A-4b88-96AA-1A7F8E8430FC}.exeC:\Windows\{F18D1B50-3A0A-4b88-96AA-1A7F8E8430FC}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A902ECF9-6645-4f95-AD1B-C1811300C6F7}.exeC:\Windows\{A902ECF9-6645-4f95-AD1B-C1811300C6F7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5BEB6D04-85F0-4374-97E7-A5C2FD41284B}.exeC:\Windows\{5BEB6D04-85F0-4374-97E7-A5C2FD41284B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71D11626-5894-4305-9469-02D36AA870FC}.exeC:\Windows\{71D11626-5894-4305-9469-02D36AA870FC}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9AC970D4-9B62-4f73-9765-8AEB0417C212}.exeC:\Windows\{9AC970D4-9B62-4f73-9765-8AEB0417C212}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1DE7B080-51DA-409a-8890-C98DADED84D2}.exeC:\Windows\{1DE7B080-51DA-409a-8890-C98DADED84D2}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9AC97~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71D11~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5BEB6~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A902E~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F18D1~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9CFF~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76770~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8E17~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1DE7B080-51DA-409a-8890-C98DADED84D2}.exe
{5BEB6D04-85F0-4374-97E7-A5C2FD41284B}.exe
{71D11626-5894-4305-9469-02D36AA870FC}.exe
{76770354-F8BB-43b8-A310-F44E2B453D17}.exe
{9AC970D4-9B62-4f73-9765-8AEB0417C212}.exe
{A902ECF9-6645-4f95-AD1B-C1811300C6F7}.exe
{D8E17C86-F2E6-42bc-93EC-5CD710F670BD}.exe
{D9CFF881-3BAE-4cda-AEFC-EC9BF65D959C}.exe
{F18D1B50-3A0A-4b88-96AA-1A7F8E8430FC}.exe